diff --git a/backend/windmill-worker/nsjail/run.csharp.config.proto b/backend/windmill-worker/nsjail/run.csharp.config.proto
new file mode 100644
index 0000000000..f8d11014a7
--- /dev/null
+++ b/backend/windmill-worker/nsjail/run.csharp.config.proto
@@ -0,0 +1,108 @@
+name: "csharp run script"
+
+mode: ONCE
+hostname: "csharp"
+log_level: ERROR
+
+disable_rl: true
+
+cwd: "/tmp"
+
+clone_newnet: false
+clone_newuser: {CLONE_NEWUSER}
+
+keep_caps: false
+keep_env: true
+mount_proc: true
+
+mount {
+    src: "/bin"
+    dst: "/bin"
+    is_bind: true
+}
+
+mount {
+    src: "/lib"
+    dst: "/lib"
+    is_bind: true
+}
+
+
+mount {
+    src: "/lib64"
+    dst: "/lib64"
+    is_bind: true
+    mandatory: false
+}
+
+
+mount {
+    src: "/usr"
+    dst: "/usr"
+    is_bind: true
+}
+
+mount {
+    src: "/dev/null"
+    dst: "/dev/null"
+    is_bind: true
+    rw: true
+}
+
+mount {
+    dst: "/tmp"
+    fstype: "tmpfs"
+    rw: true
+    options: "size=500000000"
+}
+
+
+mount {
+    src: "{JOB_DIR}/Main"
+    dst: "/tmp/main"
+    is_bind: true
+    mandatory: false
+}
+
+mount {
+    src: "{JOB_DIR}/args.json"
+    dst: "/tmp/args.json"
+    is_bind: true
+}
+
+mount {
+    src: "{JOB_DIR}/result.json"
+    dst: "/tmp/result.json"
+    rw: true
+    is_bind: true
+}
+
+mount {
+    src: "/etc"
+    dst: "/etc"
+	is_bind: true
+}
+
+mount {
+    src: "/dev/random"
+    dst: "/dev/random"
+    is_bind: true
+}
+
+mount {
+    src: "/dev/urandom"
+    dst: "/dev/urandom"
+    is_bind: true
+}
+
+iface_no_lo: true
+
+mount {
+    src: "{CACHE_DIR}"
+    dst: "/tmp/.cache/csharp"
+    is_bind: true
+    rw: true
+    mandatory: false
+}
+
+{SHARED_MOUNT}
diff --git a/backend/windmill-worker/src/csharp_executor.rs b/backend/windmill-worker/src/csharp_executor.rs
index 287a146b6a..9d38865f9c 100644
--- a/backend/windmill-worker/src/csharp_executor.rs
+++ b/backend/windmill-worker/src/csharp_executor.rs
@@ -28,6 +28,8 @@ use crate::{
 #[cfg(windows)]
 use crate::SYSTEM_ROOT;
 
+const NSJAIL_CONFIG_RUN_CSHARP_CONTENT: &str = include_str!("../nsjail/run.csharp.config.proto");
+
 lazy_static::lazy_static! {
     static ref HOME_DIR: String = std::env::var("HOME").expect("Could not find the HOME environment variable");
 }
@@ -398,29 +400,28 @@ pub async fn handle_csharp_job(
     let reserved_variables = get_reserved_variables(job, &client.token, db).await?;
 
     let child = if !*DISABLE_NSJAIL {
-        todo!();
-        // let _ = write_file(
-        //     job_dir,
-        //     "run.config.proto",
-        //     &NSJAIL_CONFIG_RUN_RUST_CONTENT
-        //         .replace("{JOB_DIR}", job_dir)
-        //         .replace("{CACHE_DIR}", RUST_CACHE_DIR)
-        //         .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
-        //         .replace("{SHARED_MOUNT}", shared_mount),
-        // )?;
-        // let mut nsjail_cmd = Command::new(NSJAIL_PATH.as_str());
-        // nsjail_cmd
-        //     .current_dir(job_dir)
-        //     .env_clear()
-        //     .envs(envs)
-        //     .envs(reserved_variables)
-        //     .env("PATH", PATH_ENV.as_str())
-        //     .env("TZ", TZ_ENV.as_str())
-        //     .env("BASE_INTERNAL_URL", base_internal_url)
-        //     .args(vec!["--config", "run.config.proto", "--", "/tmp/main"])
-        //     .stdout(Stdio::piped())
-        //     .stderr(Stdio::piped());
-        // start_child_process(nsjail_cmd, NSJAIL_PATH.as_str()).await?
+        write_file(
+            job_dir,
+            "run.config.proto",
+            &NSJAIL_CONFIG_RUN_CSHARP_CONTENT
+                .replace("{JOB_DIR}", job_dir)
+                .replace("{CACHE_DIR}", CSHARP_CACHE_DIR)
+                .replace("{CLONE_NEWUSER}", &(!*DISABLE_NUSER).to_string())
+                .replace("{SHARED_MOUNT}", shared_mount),
+        )?;
+        let mut nsjail_cmd = Command::new(NSJAIL_PATH.as_str());
+        nsjail_cmd
+            .current_dir(job_dir)
+            .env_clear()
+            .envs(envs)
+            .envs(reserved_variables)
+            .env("PATH", PATH_ENV.as_str())
+            .env("TZ", TZ_ENV.as_str())
+            .env("BASE_INTERNAL_URL", base_internal_url)
+            .args(vec!["--config", "run.config.proto", "--", "/tmp/main"])
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped());
+        start_child_process(nsjail_cmd, NSJAIL_PATH.as_str()).await?
     } else {
         let compiled_executable_name = "./Main";
         let mut run_csharp = Command::new(compiled_executable_name);